Sn1per-logo1

Sn1per Community Edition v8.4 Released!

In case you missed it, Sn1per v8.4 was released today 6/8/2020 and features a slew of new improvements and fixes which will further enhance the speed and functionality of Sn1per.

Introducing Project “Sc0pe”

To start with, Sn1per v8.4 features a completely new active and passive vulnerability scanner called “Sc0pe” which will serve as the backbone of Sn1per’s new vulnerability scan engine. The new framework will make it quick and easy to scan for the latest CVE’s and web vulnerabilities as well as open up a slew of possibilities for users to create and share their own exploits and scanners (Submit your PR’s!). For a full list of scan templates, check here.

Sc0pe Templates

Sn1per Sc0pe Templates

For anyone interested in writing or porting existing exploits over to Sc0pe, the process is super simple. First, you will need to create a new template.sh file under /usr/share/sniper/templates/active/ for active scanners and /usr/share/sniper/templates/passive/ for passive scanners. You can now copy an existing template to rename or create a new file with the following format:

AUTHOR='@xer0dayz'
VULN_NAME='Apache Solr Detected'
URI='/'
METHOD='GET'
MATCH='Solr Admin'
SEVERITY='P5 - INFO'
CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS=''
GREP_OPTIONS='-i'

Passive scanners use grep regex matching of any local file to determine vulnerability detection and use the following format:

AUTHOR='@xer0dayz'
VULN_NAME='CORS Policy - Allow-Credentials Enabled'
FILENAME="$LOOT_DIR/web/headers-htt*-$TARGET.txt"
MATCH='Access-Control-Allow-Credentials: true'
SEVERITY='P4 - LOW'
GREP_OPTIONS='-i'
SEARCH='positive'
SECONDARY_COMMANDS=''

One thing to note is that when saving template.sh file you created, be sure to not use spaces in the files (ie. CORS Policy – Allow-Credentials Enabled.sh). Instead, use underscores like “CORS_Policy_-_Allow-Credentials_Enabled.sh”.

Once your new template is created, all you need to do is run a scan. For active checks, you can choose from ‘normal’, ‘web’, ‘vulnscan’, ‘webporthttp’ and ‘webporthttps’ as well as any of the mass scan modes (ie. massweb, etc.). All other modes will only use passive scan modules to detect vulnerabilities.

Sn1per Sc0pe vulnerability report

OWASP ZAP Integration

Another major improvement added in v8.4 is the integration with OWASP ZAP. For this to work properly, you will need to have OWASP ZAP running on the same host as Sn1per and listening on port 8081/tcp.

OWASP ZAP Proxy Configuration

In addition, you will need to enable the ZAP API service and disable the API key.

OWASP ZAP API Service

The last step is to update your /root/.sniper.conf file and enable the following setting:

ZAP_SCAN="1"

After, you can run the ‘webscan’ mode (ie. sniper -t 127.0.0.1 -m webscan -w 127.0.0.1). After the scan completes, all HTML reports will be saved to /usr/share/sniper/loot/workspace/<workspace>/web/zap-report-$TARGET-$DATE.html.

Sn1per Configuration Templates

Sn1per Configuration Templates

Another major addition to Sn1per v8.4 is eight new configuration templates which can be referenced and loaded dynamically to fine tune each Sn1per scan. In the following example, we can quickly run all Metasploit web exploits against the target and skip most of the default modules to quickly scan for web vulnerabilities.

Usage: sniper -t 127.0.0.1 -m web -c /usr/share/sniper/conf/webpwn_only -w 127.0.0.1

The possibilities are endless, but you can save and reference your own custom configuration templates or use the default options and templates as a reference. Check here for some examples and feel free to submit your PR’s with your own unique templates.

Changelog

  • v8.4 – Added project “Sc0pe” active/passive vulnerability scanner
  • v8.4 – Added 68 new active sc0pe templates
  • v8.4 – Added 14 new passive sc0pe templates
  • v8.4 – Added OWASP ZAP API integration
  • v8.4 – Added 8 new Sn1per configuration templates (see /usr/share/sniper/conf/)
  • v8.4 – Added Gau (https://github.com/lc/gau)
  • v8.4 – Added rapiddns subdomain retrieval
  • v8.4 – Updated web content wordlists
  • v8.4 – Improved efficiency of ‘web’ and ‘recon’ mode scans
  • v8.4 – Disabled legacy Metasploit web exploits (check Sn1per conf to re-enable)
  • v8.4 – Fixed issue with dirsearch asterisk being used incorrectly
  • v8.4 – Fixed issue with airstrike mode not updated Sn1per Professional v8.0 host list
  • v8.4 – Fixed issue with webtech re.error: invalid group reference 1 at position 130

Updating

To apply the update, run ‘sniper -u’ if Sn1per is already installed to automatically download the latest release. For new users, run: ‘git clone https://github.com/1N3/Sn1per’ and run the install.sh file.

Sn1per-professional-fuzzer-addon-banner1

Sn1per Professional Fuzzer Add-on Released!

Automatically fuzz for OWASP TOP 10 vulnerabilities and discover hidden web content with the Fuzzer Add-on for Sn1per Professional! The new add-on comes with a host of options that can be easily configured from the Sn1per web UI and launched via the Command Execution Add-on. The result is a powerful combination of dynamic scanning options combined with professional reporting to help you quickly and easily find vulnerabilities in your environment.

Features

  • Automatically fuzz dynamic URL’s for OWASP TOP 10 vulnerabilities.
  • Discover hidden content in a target environment.
  • Spider all URL’s within a target environment.
  • Single & built-in multi target selections.
  • Customized wordlist selections and options via the GUI.
  • HTML and text based reports for all tools (ie. Black Widow, InjectX, SQLMap, Arachni, FFuf, Dirsearch, Gobuster)
  • Reporting of all output via the Command Execution Add-on.

Screenshots

Sn1per-Professional-fuzzer-addon7
Sn1per Professional Fuzzer Add-on GUI
Sn1per-Professional-fuzzer-addon12
Sn1per Professional Fuzzer Add-on HTML Reports
Sn1per Professional Fuzzer Add-on InjectX Fuzzer
Sn1per Professional Fuzzer Add-on Gobuster Hidden Web Content

Demo

Buy now!

As always, feel free to reach out to us at [email protected] with any questions!

Sn1per Professional v9.0 Demo

Aftermath2020 #002 with @xer0dayz – Live Bug Bounty Recon with Sn1per Professional

https://youtu.be/qYnfzIhTd10

Highlights:

0:00 – Basic stealth mode single domain recon with Sn1per Professional v8.0
5:00 – Leveraging built-in Sn1per Professional recon links to passively gather #OSINT
6:15 – Using InjectX fuzzer to fuzz dynamic URL’s (unreleased)
8:04 – Levaging Sn1per Professional’s Fuzzer Add-on to brute force files/directories (unreleased)
9:00 – More stealth mode single target recon with split panel/search/host jump features
11:20 – Manual scan analysis of discovered URL’s
16:20 – Levaging Sn1per Professional’s Fuzzer Add-on to brute force files/directories (unreleased)
17:35 – Use of Sn1per Professional’s host table filter
17:45 – Use of Sn1per Professional’s quick links to view websites in browser
18:52 – Use of Sn1per Professional’s built-in Google Dorks links to discover hidden content
19:20 – Levaging Sn1per Professional’s Fuzzer Add-on to brute force files/directories (unreleased)
22:22 – Using Burpsuite Professional JSLinkFinder plugin to analyze Javascript files
24:20 – Leveraging built-in Sn1per Professional recon links to passively gather #OSINT
25:54 – Discovering hidden/cached content via URLScan.io
29:55 – Use of Sn1per Professional’s built-in Notepad add-on to keep notes on workspace
30:37 – Use of Fofa to conduct recon on target domain
35:31 – Levaging Sn1per Professional’s Fuzzer Add-on to brute force files/directories with extensions (unreleased)
36:26 – Using Google dorks to discover content and URL’s
43:17 – Manual Javascript analysis from the command line
44:42 – Discovering pre-production and internal domains in Javascript files
53:18 – Digging deeper into hidden/discovered content on a target
57:14 – Discovering PayPal github repos in Javascript source
57:42 – Conducting basic github recon on PayPal developers for sensitive data

 

Sn1per Professional v9.0 Demo

Aftermath2020 #001 with @xer0dayz – Live Bug Bounty Recon with Sn1per Professional

https://www.youtube.com/watch?v=FgqdHB5YP8c&feature=youtu.be

Highlights:

0:35 – Basic single domain recon with Sn1per Professional v8.0 + Command Execution Add-on
3:27 – Analyzing scan results via split screen Sn1per Professional host reports
5:45 – Discovering hidden content via Sn1per Professional Fuzzer add-on (unreleased)
7:23 – Sn1per Professional workspace navigator search/filter
7:31 – Sn1per Professionla ‘recon’ mode to discover sub-domains
9:00 – Sn1per ‘flyover’ mode of discovered domains from the command line
13:50 – Sn1per Professional ‘web’ mode visual recon
15:00 – Sn1per Professional ‘web’ mode scan
17:30 – Analyzing scan results and browsing discovered URL’s
20:00 – Using Sn1per Professional’s recon links to perform recon on TLD
32:30 – Sn1per Professional workspace report filtering for live web hosts
33:45 – Utilizing Sn1per Professional’s quick links to view websites
38:18 – Digging deeper manually into interesting hosts
40:00 – Leveraging Burpsuite Professional with Collaborator to catch emails and analyze HTTP requests
42:26 – Running URL Fuzzer Add-on to fuzz dynamic URL’s for open redirects and CRLF vulnerabilities (unreleased)
43:56 – Using Sn1per Professional’s built-in Notepad to keep/store notes in workspace
46:55 – Discovering hidden content via Sn1per Professional Fuzzer add-on (unreleased)
48:14 – Setting up Burpsuite Professional certificate authority to intercept HTTPS traffic
49:32 – Installing and using Burpsuite CO2 plugin to scan for SQL injection
50:38 – Manually fuzzing dynamic URL’s via Burpsuite Intruder
56:24 – Manually analyzing fuzzer results to discover hidden content
1:01:00 – Brute forcing basic authentication with Sn1per Professional’s Brute Force add-on (unreleased)
1:06:36 – Manually fuzzing dynamic URL’s via Burpsuite Intruder
1:14:22 – Using Sn1per Professional’s CSV export to view host table

Sn1per Professional Brute Force Add-on Released!

Scan for weak or default credentials easily across your entire workspace with Sn1per Professional! The new Brute Force Add-on comes with a host of options that can be easily configured from the Sn1per web UI and launched via the Command Execution Add-on. The result is a powerful combination of dynamic scanning options combined with professional reporting to help you quickly and easily find vulnerabilities in your environment.

Features

  • Check for default and weak credentials in a target environment.
  • Single & built-in multi target selections.
  • Scan laterally across built-in host lists in your workspace.
  • Customized wordlist selections for usernames and passwords.
  • Automatic brute forcing of all services via BruteX.
  • Reporting of all output via the Command Execution Add-on.

Screenshots

Sn1per Professional v8.0 Brute Force Add-on
Sn1per Professional v8.0 Brute Force Add-on Scan
Sn1per Professional v8.0 Brute Force Add-on Report

Demo

Buy now!

As always, feel free to reach out to us at [email protected] with any questions!